CVE-2026-13355: Critical Meta Box AIO WordPress Plugin Flaw Enables Unauthenticated Admin Takeover — Detection and Remediation Guide

---
title: Meta Box AIO CVE-2026-13355 Object ID Override Attempt
id: 3f9c1a72-6b8e-4d21-9f4a-2c7e5b8d1a63
status: experimental
description: Detects requests containing the rwmb_frontend_field_object_id GET parameter used to override the target object_id in the Meta Box AIO mb-frontend-submission component (CVE-2026-13355). Presence of this parameter in access logs indicates probing or active exploitation of the unauthenticated privilege escalation chain.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-13355
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: 'rwmb_frontend_field_object_id'
  falsepositives:
    - Rare; legitimate Meta Box frontend submissions populate object_id server-side and do not normally place this parameter in client-controlled query strings
level: high
---
title: Meta Box AIO Frontend Submission Form Processed With Injected Shortcode Content
id: 8a2e4b61-1c7d-4f39-b5e2-9d3a6c1f8e47
status: experimental
description: Detects POST requests to WordPress pages hosting Meta Box frontend submission forms where the query string carries an attacker-supplied object ID targeting administrative or high-value content, consistent with the Form::process() missing authorization check in CVE-2026-13355.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-13355
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
    cs-uri-query|contains: 'rwmb_frontend_field_object_id='
  selection_shortcode:
    cs-uri-query|contains:
      - 'mb_user_profile'
      - '[mb_user_profile'
  condition: selection_method or selection_shortcode
falsepositives:
  - Site administrators testing frontend submission forms during development
level: critical

// Hunt 1: Requests carrying the CVE-2026-13355 object_id override parameter
let SuspiciousParam = "rwmb_frontend_field_object_id";
let IISHits = W3CIISLog
    | where csUriQuery has SuspiciousParam
    | project TimeGenerated, cIP, sSiteName, csMethod, csUriStem, csUriQuery, scStatus, csUserAgent, Computer
    | extend Source = "IIS";
let SyslogHits = Syslog
    | where SyslogMessage has SuspiciousParam
    | project TimeGenerated, HostIP, Computer, ProcessName, SyslogMessage
    | extend Source = "Syslog";
let CefHits = CommonSecurityLog
    | where RequestURL has SuspiciousParam or AdditionalExtensions has SuspiciousParam
    | project TimeGenerated, SourceIP, RequestMethod, RequestURL, DeviceAction, DeviceProduct, SourceHostName
    | extend Source = "CEF";
union IISHits, SyslogHits, CefHits
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RequestCount=count()
    by Source, cIP, SourceIP, csUriStem, csUserAgent
| order by RequestCount desc;

// Hunt 2: POST requests to frontend submission pages with object_id override,
// followed by admin-side activity from the same source IP within 1 hour
let Window = 1h;
let ExploitIPs = W3CIISLog
    | where csMethod == "POST" and csUriQuery has "rwmb_frontend_field_object_id"
    | extend ExploitTime = TimeGenerated
    | summarize by cIP, ExploitTime;
W3CIISLog
| where csUriStem has_any ("/wp-admin/", "/wp-login.php", "user-new.php", "admin-ajax.php")
| join kind=inner (ExploitIPs) on cIP
| where TimeGenerated between (ExploitTime .. (ExploitTime + Window))
| project ExploitTime, FollowUpTime=TimeGenerated, cIP, csUriStem, csUriQuery, scStatus, csUserAgent
| order by ExploitTime asc;

-- Hunt web server access logs for CVE-2026-13355 object_id override attempts
LET log_files <= SELECT FullPath, Mtime, Size
FROM glob(globs=[
    '/var/log/nginx/access.log*',
    '/var/log/apache2/access.log*',
    '/var/log/apache2/other_vhosts_access.log*',
    '/var/log/httpd/access_log*',
    '/var/log/nginx/*/access.log*'
])
WHERE Size > 0

SELECT FullPath, Mtime AS LogMtime,
       parse_string_with_regex(
           string=Line,
           regex='^(?P<SrcIP>[0-9a-fA-F\\.:\\%]+) .*?\\\"(?P<Method>[A-Z]+) (?P<URI>[^\" ]*) (?P<Proto>[^\"]*)\\\" (?P<Status>[0-9]+)'
       ).SrcIP AS SourceIP,
       parse_string_with_regex(
           string=Line,
           regex='^(?P<SrcIP>[0-9a-fA-F\\.:\\%]+) .*?\\\"(?P<Method>[A-Z]+) (?P<URI>[^\" ]*) (?P<Proto>[^\"]*)\\\" (?P<Status>[0-9]+)'
       ).Method AS Method,
       parse_string_with_regex(
           string=Line,
           regex='^(?P<SrcIP>[0-9a-fA-F\\.:\\%]+) .*?\\\"(?P<Method>[A-Z]+) (?P<URI>[^\" ]*) (?P<Proto>[^\"]*)\\\" (?P<Status>[0-9]+)'
       ).URI AS RequestURI,
       parse_string_with_regex(
           string=Line,
           regex='^(?P<SrcIP>[0-9a-fA-F\\.:\\%]+) .*?\\\"(?P<Method>[A-Z]+) (?P<URI>[^\" ]*) (?P<Proto>[^\"]*)\\\" (?P<Status>[0-9]+)'
       ).Status AS Status
FROM foreach(row=log_files,
query={
    SELECT Line, FullPath FROM parse_lines(filename=FullPath)
    WHERE Line =~ 'rwmb_frontend_field_object_id'
})
ORDER BY LogMtime DESC

#!/usr/bin/env bash
# CVE-2026-13355 - Meta Box AIO <= 3.11.0 unauthenticated privilege escalation
# Audit and remediation helper. Run as root or a user with WP-CLI access.
set -euo pipefail

WP_ROOTS=("/var/www" "/srv/www" "/home")
WPCLI="wp --allow-root"
VULN_MAX="3.11.0"

echo "=== CVE-2026-13355 Meta Box AIO Audit ==="

# 1) Locate WordPress installs and check meta-box-aio version
find "${WP_ROOTS[@]}" -maxdepth 4 -name wp-config.php 2>/dev/null | while read -r cfg; do
    site_dir=$(dirname "$cfg")
    echo "[+] Checking site: $site_dir"
    ver=$(cd "$site_dir" && $WPCLI plugin get meta-box-aio --field=version 2>/dev/null || echo "not-installed")
    if [[ "$ver" == "not-installed" ]]; then
        echo "    meta-box-aio not present. Skipping."
        continue
    fi
    echo "    Installed meta-box-aio version: $ver"
    if [[ "$(printf '%s\n%s\n' "$ver" "$VULN_MAX" | sort -V | head -n1)" == "$ver" ]] && [[ "$ver" != "$VULN_MAX" || "$ver" == "$VULN_MAX" ]]; then
        if [[ "$ver" == "$VULN_MAX" || "$(printf '%s\n%s\n' "$ver" "$VULN_MAX" | sort -V | tail -n1)" == "$VULN_MAX" ]]; then
            echo "    [!] VULNERABLE (<= $VULN_MAX). Attempting update..."
            (cd "$site_dir" && $WPCLI plugin update meta-box-aio) || {
                echo "    [!!] Update failed - DEACTIVATING plugin as emergency mitigation"
                (cd "$site_dir" && $WPCLI plugin deactivate meta-box-aio)
            }
            new_ver=$(cd "$site_dir" && $WPCLI plugin get meta-box-aio --field=version 2>/dev/null || echo "unknown")
            echo "    Post-action version: $new_ver"
        fi
    else
        echo "    [OK] Version appears patched (> $VULN_MAX). Verify against vendor advisory."
    fi
done

# 2) Hunt access logs for the exploit parameter (last 90 days of logs)
echo ""
echo "=== Hunting access logs for rwmb_frontend_field_object_id ==="
LOG_DIRS=("/var/log/nginx" "/var/log/apache2" "/var/log/httpd")
for d in "${LOG_DIRS[@]}"; do
    [[ -d "$d" ]] || continue
    echo "[+] Scanning $d"
    zgrep -h -i "rwmb_frontend_field_object_id" "$d"/*access*.log* 2>/dev/null | \
        awk '{print $1, $7}' | sort | uniq -c | sort -rn | head -50 || echo "    No hits in $d"
done

# 3) Check for recently created administrator accounts (possible post-exploitation)
echo ""
echo "=== Auditing recent Administrator accounts ==="
find "${WP_ROOTS[@]}" -maxdepth 4 -name wp-config.php 2>/dev/null | while read -r cfg; do
    site_dir=$(dirname "$cfg")
    echo "[+] Site: $site_dir"
    (cd "$site_dir" && $WPCLI user list --role=administrator \
        --fields=ID,user_login,user_email,user_registered --format=table) 2>/dev/null || true
done

echo ""
echo "=== Done. Review any log hits and unfamiliar admin accounts immediately. ==="

# ModSecurity WAF rule - block CVE-2026-13355 object_id override parameter
SecRule ARGS_GET_NAMES "@contains rwmb_frontend_field_object_id" \
    "id:90013355,phase:1,deny,status:403,log,msg:'CVE-2026-13355 Meta Box AIO object_id override attempt'"
# Verify rule is active after reload:
apachectl -t && systemctl reload apache2
tail -f /var/log/apache2/error.log | grep 90013355